Review Of The Audit And Risk Committee Charter & Review Of The Internal Audit Policy · Attachment 2_Internal Audit Policy_Draft

INTERNAL AUDIT POLICY



   a) Reports will consist of an Executive Summary and a Detailed Audit Report. Also, the
      reports will incorporate statements as to the objective, scope and nature of the audit,
      audit conclusions, appropriate recommendations for improvement and associated risk
      assessments aligned to council’s Risk Rating Criteria and Risk Rating Matrix and
      acknowledge good practice and any remedial action in process.

   b) Matters arising during audits, including matters for possible inclusion in reports will, on
      completion of the audit, be discussed with the appropriate with the responsible
      Manager.

   c) Matters resolved at the time of the internal audit will be listed in the issued audit report
      for transparency.

   d) At the completion of an audit, the Internal Auditor will discuss their findings and
      recommendations with the appropriate officers concerned to ensure that internal audit
      and management agree on the findings and jointly develop any recommendations
      considered necessary. Recommendations should be developed with the following
      considerations:
           Timeframes should be realistic and achievable to ensure there is sufficient time
             for findings to be considered and to develop appropriate responses.
           Recommendations should be clearly defined and actionable.
           Recommendations should contain simple actions and be singularly identified
             allowing progress to be easily tracked.
           Dependencies or prerequisite requirements that impact the implementation of
             recommended actions should be identified.
           Resourcing and organisational capacity.

   e) For significant recommendations requiring considerable investment or resources,
      identify immediate controls or activities that can be implemented to reduce risk until full
      action can be completed so as to ensure immediate steps are taken to mitigate risks.

   f)   A draft audit report will be provided, and a meeting arranged with the relevant
        manager/stakeholders to discuss the audit findings. Management responses to the
        audit recommendations will then be developed and provided to the internal auditor
        within 21 days of the draft report being issued or otherwise as agreed.

   g) The Internal Auditor will issue a final report to the Chief Executive Officer for
      presentation to the next Audit and Risk Committee meeting. Depending on the timing
      of Committee Meetings a draft report may be presented for the Committee’s
      information and to provide an opportunity for the Committee to clarify or provide
      feedback on information contained within the draft report.

   h) At the request of the Audit and Risk Committee (in consultation with the CEO), the
      Internal Auditor may be required to provide a report summarising significant issues
      arising out of audits undertaken during the year. They may also be required to provide
      independent verification that any high-risk issues have been addressed, and to
      undertake an assessment of the implementation of audit recommendations. The report
      may include reference to areas where weaknesses were encountered, suggested
      remedial measures and any general observations or recommendations considered



                                                                                         Page 10